DNS, or the Domain Name System, is often referred to as the phonebook of the internet. It translates human-readable domain names (like example.com) into machine-readable IP addresses (like 192.0.2.44). This system allows users to access websites by typing in easy-to-remember domain names instead of complex numerical IP addresses.

A default DNS server is provided by the user's Internet Service Provider (ISP), but the user can change the DNS server on the mobile phone or computer to other public DNS servers, such as 1.1.1.1, 8.8.8.8 and 9.9.9.9 provided by Cloudflare, Google and Quad9, respectively.

By default, DNS traffic is not encrypted. This means that third parties can see users' DNS queries, which include the domain names of the applications they are using. This can potentially expose users' browsing history and other sensitive information to ISPs, network administrators, or any eavesdroppers monitoring the network.

There are two main methods for encrypting DNS traffic: DNS over TLS (DoT) and DNS over HTTPS (DoH). Both methods use Transport Layer Security (TLS) to encrypt the data between the DNS client (such as a web browser) and the DNS resolver (the server that translates domain names into IP addresses).

A list of publicly available DoH servers

https://github.com/curl/curl/wiki/DNS-over-HTTPS

Today, browsers such as Google Chrome and Firefox enable DNS over HTTPS (DoH) by default. Both iOS and Android support DoH but require further configuration, and Windows does not natively support DoH.

You can use Cloudflare's cloudflared client to proxy DoH locally(assuming your IP address is 192.168.0.87 ).

cloudflared proxy-dns --address 192.168.0.87 --port 53 --upstream https://dns.quad9.net/dns-query
Adding DNS upstream url=https://dns.quad9.net/dns-query
Starting metrics server on 127.0.0.1:2798/metrics
Starting DNS over HTTPS proxy server address=dns://192.168.0.87:53

Now other users on the same local network can configure their DNS server to 192.168.0.87 , and all their DNS traffic will be proxy through DoH to https://dns.quad9.net/dns-query.

VPN users may think they are safe but that's not always true, this can happen if the VPN is configured to only route certain traffic through the VPN tunnel. In some system an application can also bypass the VPN by modifying the system route table. You can perform DNS leak tests using online tools like dnsleak.com to ensure that the VPN is functioning correctly.